lang 2.4: enforce interface-only access on pack elements

A protocol-constrained pack element exposes only the constraint protocol's
interface (the locked decision): `xs[i].<member>` is rejected unless `<member>`
is one of the protocol's methods. `xs[i].v` (a concrete field of IntCell, not
declared on Box) now errors, like a constrained generic — even though the
substituted element is concretely an IntCell.

monomorphizePackFn records the pack param's constraint protocol in a new
`pack_constraint` map (pack-name → protocol); lowerFieldAccess checks it on an
`xs[i]` (index_expr) base BEFORE substitution erases the "constrained to P"
context. Protocol method calls (`xs[i].get()`) pass — the name is in the
protocol. Regression: examples/195-pack-interface-only.sx.

examples/195-pack-interface-only.sx

@@ -0,0 +1,22 @@
+// Feature 1 — a pack element exposes ONLY the constraint protocol's interface.
+// `xs[i].v` reaches a concrete field of IntCell that is not part of `Box`, so
+// it's rejected even though IntCell does have `v` — a pack element is viewed
+// through the protocol, like a constrained generic. (Protocol methods like
+// `get()` ARE callable; see examples 193/194.)
+
+#import "modules/std.sx";
+
+Box :: protocol(T: Type) {
+    get :: () -> T;
+}
+IntCell :: struct { v: s64; }
+impl Box(s64) for IntCell { get :: (self: *IntCell) -> s64 => self.v; }
+
+leak :: (..xs: Box) -> s64 {
+    return xs[0].v;   // `v` is not part of Box — error
+}
+
+main :: () -> s32 {
+    print("{}\n", leak(IntCell.{ v = 5 }));
+    0;
+}